For companies, threats come from two sources—outside the organization and inside (reads: disgruntled, unethical employees). Insider threats can be very difficult to handle and the number of annual incidents is on the rise. The insider threat can come in several forms: Employees who steal intellectual…
BREACH attacks: Browser Reconnaissance and Exfiltration via Adaptive Compression of Hypertext
BREACH attacks, abbreviated from Browser Reconnaissance and Exfiltration via Adaptive Compression of Hypertext, are attacks similar to the CRIME attack. Both attacks are compression side channel attacks, however CRIME targets information compressed in HTTP requests through TLS compression, whilst BREACH targets information compressed in HTTP…
The importance of Internal Web Security Assessments
What do things look like on the outside? That’s the main focus we have as human beings. But beauty is only skin deep. As with relationships and leaked NSA documents, we quickly discover that what’s on the inside is just as, if not more, important….
Server Side Request Forgery (SSRF)
A Server Side Request Forgery (SSRF) attack gives an attacker the ability to use your web application to send requests to other applications running on the same machine, or to other servers which can be on the same or on a remote network. Since the…
Automatic detection of XXE vulnerabilities in OpenID implementations using Acunetix AcuMonitor
Reginaldo Silva recently uncovered a very interesting bug affecting Facebook (and received $33,500 for this discovery). The bug is caused by improper handling of XML documents in OpenID implementations causing XML External Entity Expansion vulnerabilities. He mentioned in his article that many OpenID implementations/libraries are…
New Security Checks Added to Acunetix Web Vulnerability Scanner
The latest build of Acunetix Web Vulnerability Scanner includes a lot of changes and new security tests. Here is a short summary of the most interesting tests we’ve just added. 1. Vulnerable JavaScript libraries Acunetix Web Vulnerability Scanner can now identify vulnerable versions of various JavaScript…
Understanding the value of the OWASP Top 10 2013
Find out how IT security professionals can benefit from the free resources available from the OWASP Top 10 2013 List of Risks. As IT security professionals we certainly have our fair share of information available to simplify the work we do. There’s the CVE dictionary,…
OWASP Updated the Top 10 List of Risks for 2013
Last week, the OWASP team officially updated the Top 10 list of risks so as to make it relevant for the web attack vectors identified in the last three years. The OWASP Top Ten summarizes and often combines web application vulnerabilities into an easy to interpret and…
WordPress Caching Plugins Remote PHP Code Execution
Two very popular WordPress caching plugins: WP Super Cache (4,373,811 downloads) and W3 Total Cache (1,975,480 downloads) have been affected by a vulnerability that allows remote users to execute arbitrary PHP code. The affected versions are: WP Super Cache (version 1.2 and below, version 1.3.x and up are…